data protection

PRIVACY POLICY

1. Overview

If you are a customer or business partner, or if you use our IMMOinstant software, please read from section III onward.

If you visit our website, please read from section II onward.

1. What data do we process when you visit our website?

Welcome to our website! Please take a moment to familiarize yourself with how we process your personal data when you visit our website (Articles 13 and 14 of the GDPR; Section 165(3) of the Telecommunications Act).

When you visit our website, the following data may be processed:

• Browser type,
• Operating system,
• Country,
• Date,
• Time and duration of access,
• IP address and pages visited on our website, including entry and exit pages,
• Contact page on the website,
• Device data: We may store personal data from your device. Such data includes geolocation data, IP address, unique identifiers (e.g., MAC address),
• Email address for newsletter subscription (optional)

The processing of this data is necessary to ensure the secure operation of the website and to guarantee its functionality from a technical standpoint. This data is collected in part via technical cookies. These technical cookies are used only to the extent necessary (Section 165(3) TKG). The processing of this data is justified by our legitimate interest in operating our website (Article 6(1)(f) GDPR).

In order to operate our website, we may need to disclose your data to the following recipients:

• Recipient Information: Google LLC (Google Analytics)
  • Purpose of data processing: Statistical and marketing purposes
  • Legal basis for data processing: Consent regarding Google Analytics (Article 6(1)(a) of the GDPR)
  • Headquarters: United States
  • Secure transfer to third countries: Google LLC is listed under the EU-U.S. Data Privacy Framework (HR and non-HR data)

• Recipient Information: Meta Platforms, Inc.
  • Purpose of data processing: Statistical and marketing purposes
  • Legal basis for data processing: Consent (Article 6(1)(a) of the GDPR)
  • Headquarters: United States
  • Secure transfer to third countries: Meta Platforms, Inc. is listed under the EU-U.S. Data Privacy Framework (however, only with respect to non-HR data)

• Recipient Information: Pipedrive OÜ (CRM)
  • Purpose of data processing: CRM system
  • Legal basis for data processing: Primarily legitimate interest (Article 6(1)(f) of the GDPR)
  • Headquarters: Estonia
  • Secure transfer to a third country: Within the EU

• Recipient Information: Amazon.com, Inc. AWS
  • Purpose of data processing: Website hosting
  • Legal basis for data processing: Primarily legitimate interest (Article 6(1)(f) of the GDPR)
  • Headquarters: United States
  • Secure transfer to a third country: Amazon.com, Inc. is registered under the EU-U.S. Privacy Shield Framework (however, only with respect to non-HR data)

• Recipient Information: Sendinblue GmbH (Brevo)
  • Purpose of data processing: Sending newsletters
  • Legal basis for data processing: Consent (Article 6(1)(a) of the GDPR)
  • Headquarters: Germany
  • Secure transfer to a third country: Within the EU

II.1. Overview of the "technical" cookies used

The data mentioned above is stored using so-called“cookies.”Cookies are text files that are stored on your computer and enable us to analyze how the website is used. They are used to recognize and store temporary data about website visitors. We generally use cookies only to the extent necessary to communicate with you through the website.

These technical cookies are enabled as soon as you visit our website.

The following cookies are used on our website based on our legitimate interest (Article 6(1)(f) of the GDPR):

See our Cookie Policy

II.2. Overview of the "advertising cookies" used

In addition to the “technical cookies” described above, we also use so-called advertising cookies (including “statistical cookies”). These advertising cookies allow us to better understand and analyze your interests. With the help of advertising cookies, we can combine your “browsing behavior” beyond the boundaries of our website with data from other websites. This enables us to better understand the interests of our website visitors and address them in a more targeted manner.

We understand that not every visitor to the website wishes to do this. Therefore, we process your data in connection with advertising cookies only if you consent to it (Article 6(1)(a) of the GDPR). You may withdraw this consent at any time, although the data processing carried out up to the time of withdrawal remains lawful.

A list of advertising cookies:

Read our Cookie Policy here

1. For what purposes do we process your data if you are a customer of ours, have a business relationship with us, or use our software?

In the course of our business relationship with customers and business partners, as well as in connection with the provision of the software, we process data based on contractual obligations ( fulfillment of the contractual relationship with you, pre-contractual obligations, billing for services, sending documents, communication regarding the fulfillment of the contract, provision of the software) and legal obligations ( legally required retention pursuant to Section 132 of the Austrian Federal Tax Code) (Art. 6(1)(b) and (c) GDPR) as well as based on our legitimate interests or the legitimate interests of third parties (Art. 6(1)(f) GDPR), namely:

• for the purposes of internal administration and management of your case to the extent necessary (e.g., processing your case, forwarding your case to an assistant, filing, archiving, and correspondence with you);

• for the purpose of providing the software;

• Asserting and defending legal claims

to the extent necessary in each case. We process your data for the purpose of establishing, maintaining, and conducting our business relationships. If you do not provide us with this data, we will unfortunately be unable to process your transaction.

Where applicable, we process your data based on your voluntary, explicit consent (Article 6(1)(a) of the GDPR).

III.1. What data is processed in connection with the conduct of a business relationship?

In the course of conducting or fulfilling our business relationships with our customers and suppliers, we process the following personal data or categories of personal data:

• Passwords for the user account
• Username
• Name
• Address
• User photo
• email
• payment details
• User's scheduled appointments
• Credit reports based on self-reported information
• Desired move-in date
• Any guarantors

1. How long will your data be stored?

We will retain your data only for as long as is necessary for the purposes for which we collected it. In this context, statutory retention requirements must be taken into account (for example, for tax purposes, contracts and other documents arising from our contractual relationship must generally be retained for a period of seven years (Section 132 of the Federal Tax Code)). In justified individual cases, such as to assert or defend legal claims, we may also store your data for up to 30 years after the termination of the business relationship.

We retain data from prospective clients for up to one year from the date of their last contact with us. Please note that these retention periods also apply to real estate agents who use the IMMOinstant software.

1. Who might receive your data?

In the course of our business relationship and your use of the software, we may need to share your data with the following recipients:

• Recipient Information: Google LLC (Google Calendar)
  • Purpose of data processing: Calendar synchronization;
  • Legal basis for data processing: Primarily legitimate interest (Article 6(1)(f) of the GDPR)
  • Headquarters: United States
  • Secure transfer to third countries: Google LLC is listed under the EU-U.S. Data Privacy Framework (HR and non-HR data)

• Recipient information: Microsoft (Outlook) and Microsoft Teams
  • Purpose of data processing: calendar synchronization and online meetings;
  • Legal basis for data processing: Primarily legitimate interest (Article 6(1)(f) of the GDPR)
  • Headquarters: United States
  • Secure transfer to third countries: Microsoft is listed under the EU-US Data Privacy Framework (HR and non-HR data)

• Recipient information: onOffice Austria GmbH (CRM); onOffice GmbH; onOffice Italia SRL
  • Purpose of data processing: CRM
  • Legal basis for data processing: Primarily legitimate interest (Article 6(1)(f) of the GDPR)
  • Headquarters: Austria, Germany, Italy
  • Secure transfer to a third country: Within the EU

• Recipient Information: Justimmo B&G Consulting & Commerce GmbH (CRM)
  • Purpose of data processing: CRM
  • Legal basis for data processing: Primarily legitimate interest (Article 6(1)(f) of the GDPR)
  • Headquarters: Austria
  • Secure transfer to a third country: Within the EU

• Recipient Information: Meta Platforms, Inc. (WhatsApp)
  • Purpose of data processing: Communication tools
  • Legal basis for data processing: Consent regarding WhatsApp (Article 6(1)(a) of the GDPR)
  • Headquarters: United States
  • Secure transfer to third countries: Meta Platforms, Inc. is listed under the EU-U.S. Data Privacy Framework (however, only with respect to non-HR data)

• Special Note: Please note that we will only communicate via WhatsApp if you have expressly consented to its use.

• Recipient Information: Stripe
  • Purpose of data processing: Payment processing
  • Legal basis for data processing: Contractual necessity (Article 6(1)(b) of the GDPR)
  • Headquarters: United States

• Recipient Information: Volksbank Wien
  • Purpose of data processing: Payment processing
  • Legal basis for data processing: Contractual necessity (Article 6(1)(b) of the GDPR)
  • Headquarters: Austria

• Recipient Information: Attorney based in Austria
  • Purpose of data processing: Legal advice
  • Legal basis for data processing: legitimate interest (Article 6(1)(f) of the GDPR) and contractual necessity (Article 6(1)(b) of the GDPR)
  • Headquarters: Austria
  • Basis for transfer to a third country: Within the EEA

• Recipient Information: Tax advisor based in Vienna (Fussenegger & Partner Wirtschaftsprüfungs- und Steuerberatungs GmbH)
  • Purpose of data processing: Tax consulting
  • Legal basis for data processing: legitimate interest (Article 6(1)(f) of the GDPR) and contractual necessity (Article 6(1)(b) of the GDPR)
  • Headquarters: Vienna
  • Basis for transfer to a third country: Within the EEA

• Recipient Information: Software developer based in Vienna
  • Purpose of data processing: Software development
  • Legal basis for data processing: legitimate interest (Article 6(1)(f) of the GDPR); data processing agreement pursuant to Article 28 of the GDPR
  • Headquarters: Vienna
  • Basis for transfer to a third country: Within the EEA

• Recipient Information: Hetzner Online GmbH
  • Purpose of data processing: Hosting
  • Legal basis for data processing: Primarily legitimate interest (Article 6(1)(f) of the GDPR); Data Processing Agreement pursuant to Article 28 of the GDPR
  • Headquarters: Germany
  • Legal basis for the transfer to a third country: Within the EEA

• Recipient Information: OVWH GmbH
  • Purpose of data processing: Backup
  • Legal basis for data processing: Primarily legitimate interest (Article 6(1)(f) of the GDPR); Data Processing Agreement pursuant to Article 28 of the GDPR
  • Headquarters: Germany
  • Legal basis for the transfer to a third country: Within the EEA

1. Collection of data from other sources (Article 14 of the GDPR)

An API interface is available for integrating the software with onOffice or Justimmo. onOffice and Justimmo, in turn, retrieve data from public real estate portals and marketing platforms. The data is thus transferred from the real estate portals and marketing platforms to the CRM software (onOffice or Justimmo) and from there to the IMMOinstant software. This process may also involve the processing of personal data:

• Source: onOffice Austria GmbH, onOffice GmbH; onOffice Italia SRL
• Data: Name, phone number, email address, property of interest to the home seeker
• Company headquarters: Vienna, Austria

• Source: B&G Consulting & Commerce GmbH (Justimmo)
• Data: Name, phone number, email address, property of interest to the home seeker
• Company headquarters: Vienna, Austria

1. Is automated decision-making or profiling taking place (Article 13(2)(f) of the GDPR)?

Our company does not engage in automated decision-making or profiling.

1. What rights do you have regarding data processing?

We would like to inform you that, provided the legal requirements are met:

• You have the right to request information about what data we process about you (see Article 15 of the GDPR for details).
• You have the right to request the correction or completion of inaccurate or incomplete data concerning you (see Article 16 of the GDPR for details).
• You have the right to have your data erased (see Article 17 of the GDPR for details).
• You have the right to object to the processing of your data that is necessary to protect our legitimate interests or those of a third party (see Article 21 of the GDPR for details). This applies in particular to the processing of your data for marketing purposes.
• You have the right to receive the data you have provided in a structured, commonly used, and machine-readable format.

If we process your data based on your consent, you have the right to withdraw that consent at any time by email. This does not affect the lawfulness of the data processing carried out up to that point (Article 7(3) of the GDPR).

‍

‍

1. What rights do you have to file a complaint?

If, contrary to expectations, your right to the lawful processing of your data is violated, please contact us by mail or email. We will make every effort to address your concern promptly. You also have the right to file a complaint with the data protection supervisory authority responsible for your area.

The address of the Austrian Data Protection Authority is:

Austrian Data Protection Authority

40–42 Barichgasse,

1030 Vienna

1. How can you contact us?

If you have any further questions about the processing of your data, please feel free to contact our Data Protection Coordinator using the contact information provided below.

1. Responsible parties

The controller within the meaning of Article 4(7) of the GDPR is:

IMMOinstant FlexCo

30 Cobenzlgasse, 1190 Vienna

Phone: +43 670 1936075
Email: info@immoinstant.at
Website: www.immoinstant.at

Author of this Privacy Policy: Attorney Dr. Tobias Tretzmüller, LL.M.; www.digital-recht.at

Any use of this privacy policy, or even parts thereof, without the author's consent constitutes a copyright infringement.

‍